Breaking changes
Both presets now pin the Talos v1.14 contract. A new project from talm init renders configs that only load on nodes already running Talos v1.14. Existing projects keep their pins until talm init --update rewrites Chart.yaml, and the upgrading guide says what that command offers before you accept it.
Default Kubernetes versions move with it: cozystack v1.36.5 (was v1.34.3), generic v1.37.0 (was v1.36.2). The cozystack install image is ghcr.io/cozystack/cozystack/talos:v1.14.2.
On v1.14 the charts write the Kubernetes settings as typed documents (KubeClusterConfig, KubeNodeConfig, KubeletConfig, KubeNetworkConfig and the control-plane components) and keep only etcd in v1alpha1. Below v1.14 the rendered output is unchanged, apart from the new cozystack default image. talm apply refuses a node file rendered on an older contract: save its hand-written body, run talm template -I --file <node file>, put the body back.
Cozystack oidcIssuerUrl becomes a JWT authenticator in KubeAuthenticationConfig on v1.14, with the same claims and the <issuer># username prefix. oidc-*, anonymous-auth, authentication-config and authorization-* keys in extraApiServerArgs fail the render on v1.14.
Preset hashes changed, so projects with .talm-preset.lock report preset drift until talm init --update --preset <preset> is run.
Upgrade
talm upgradeasks Talos before the RPC and refuses a move it will not make, a jump from too far back or a downgrade past what Talos supports.--skip-upgrade-path-checkopts out. (#243)- It warns when a node body carries an install image other than
values.yaml::image, and the--imagehelp says where the image really comes from. (#243)
Cozystack preset
- Load
drbd_transport_tcpexplicitly. On Talos v1.14 DRBD stays Diskless without it. (#252) - Skip the ZFS pool export on shutdown by default, it hangs a LINSTOR-on-ZFS node in
rebooting.zfs.exportOnShutdown: truebrings it back. (#251)
Apply
- The dry-run diff masks multi-line secrets such as PEM keys, and the node's own side of the diff. Typed-document secrets are masked in the drift preview. (#259)
- Partial edits of a node file keep replace-merged fields and list-valued
extraArgswhole. (#259) init --updateno longer promises an interactive diff: it asks for each preset file and overwrites it whole. (#259)
CI
- golangci-lint v2.14.0. (#262)
Changelog
- 141740f Merge pull request #259 from cozystack/fix/charts-talos-v114-contract
- 0dd28fc fix(apply): mask the node's side of the dry-run diff
- 5ec4e98 fix(init): stop promising an interactive diff on preset update
- c8e651d fix(engine): keep replace-merged fields whole in node files
- 06642ce fix(apply): refuse a node file that restores superseded fields
- 901ace7 feat(charts): pin both presets to the Talos v1.14 contract
- 03d1466 fix(apply): redact secrets that live in typed documents
- 0548298 feat(charts): render the Talos v1.14 config contract
- f68e98a refactor(charts): share the advertisedSubnets list and arg indent
- 5881e65 fix(engine): merge chart Kubernetes documents into the bundle
- cfc5a95 Merge pull request #262 from cozystack/ci/golangci-lint-v2.14
- 61d9e7a ci: bump golangci-lint to v2.14.0
- b08c591 Merge pull request #251 from cozystack/fix/cozystack-zfs-export-on-shutdown
- 95c63fc fix(cozystack): skip ZFS pool export on shutdown by default
- 7f7409c Merge pull request #252 from cozystack/fix/drbd-transport-tcp
- c4f62f4 fix(cozystack): load drbd_transport_tcp explicitly
- dac1d2c Merge pull request #243 from cozystack/feat/upgrade-image-visibility
- 7203b41 feat(upgrade): refuse a move Talos will not make
- 64e2f91 fix(upgrade): warn when a node body points at a different image
- 5f13021 fix(upgrade): say where the install image actually comes from